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AMENDMENTS TO THE CLAIMS 
Please amend claims 14 and 28, as follows. A complete listing of the claims is provided 

below. 

1. (Previously Presented) A method of monitoring a network switch having a plurality 
of regular ports between which network traffic data packets are forwarded and an external mirror 
port comprising: 

selecting at least one of said regular ports; 

mirroring a data packet of said selected port to said external mirror port; 
extracting the network address information of said mirrored data packet; 
determining port information of said network address information in response to said 
network address information extraction; and 

performing network analysis of said network switch. 

2. (Previously Presented) The method of claim 1, wherein said port information 
comprises physical information. 

3. (Previously Presented) The method of claim 1, wherein said port information 
determination comprises interrogating said network switch to obtain said port information using 
said network address information. 

4. (Previously Presented) The method of claim 3, wherein said interrogation comprises: 
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sending a first request to said network switch requesting a port index corresponding to said 
network address information; and 

sending a second request to said network switch requesting said port information 
corresponding to said port index. 

5. (Previously Presented) The method of claim 1, wherein said network address 
information extraction and said port information deterrnination are performed in an external 
monitor device, 

6. (Cancelled). 

7. (Previously Presented) The method of claim 4, wherein said port information 
determination comprises placing said inirrored data packet in a first-in-fixst-out buffer waiting for 
responses from said network switch. 

8. (Previously Presented) The method of claim 7, wherein said port information 
determination further comprises releasing said mirrored data packet from said fust-in-hrst-out 
buffer after said network switch responds to said requests. 

9. (Previously Presented) The method of claim 7, wherein said port information 
determination further comprises releasing said mirrored data packet from said first-in-flrst-out 
buffer after a predetermined period of time. 
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10. (Previously Presented) The method of claim 1, further comprising maintaining at 
least one lookup table correlating said network address information with said port information. 

11. (Previously Presented) The method of claim 1, wherein said network address 
information comprises a source address of said mirrored data packet 

12. (Previously Presented) The method of claim 1, wherein said network address 
information comprises a destination address of said mirrored data packet. 

13. (Previously Presented) The method of claim 1, wherein said network switch is a 
routing switch. 

14. (Currently Amended) A method to monitor a network switch, comprising: 
externally obtaining at least a portion of data packets received a t transmitted from said 

network switch, wherein each of said data packets comprises network address information; 

extracting said network address information from said obtained portion of data packets; 

determining port information of said network address information in response to said 
network address information extraction; and 

performing network analysis of said network switch using said port information. 

15. (Previously Presented) The method of claim 14, wherein said port information 
comprises physical information. 
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16. (Previously Presented) The method of claim 14, wherein said network switch 
comprises a plurality of regular ports and a mirror port, said mirror port being able to mirror 
network traffic for at least one of said regular ports, wherein said portion of data packets are 
obtained from said mirror port. 

17. (Previously Presented) The method of claim 14, wherein said network address 
information comprises source addresses. 

18. (Previously Presented) The method of claim 14, wherein said network address 
information comprises destination addresses. 

19. (Previously Presented) The method of claim 14, wherein said network switch 
comprises a plurality of regular ports, wherein said portion of data packets are obtained by 
passively tapping at least one of said regular ports. 

20. (Previously Presented) The method of claim 14, wherein said port information 
deterrnination comprises interrogating said network switch to obtain said port information using 
said network address information. 

21. (Previously Presented) The method of claim 20, wherein said interrogation 
comprises: 

sending a first request to said network switch requesting a port index corresponding to said 
network address information; and 

PA/S21 83927.1 g 



PAGE 8/19 * RCVD AT 6/9/2006 5:45:21 PM [Eastern Daylight Time] * SVR:USPT0-EFXRF-1/14 * DNIS:2738300 * CSID:6508494800 * DURATION (mm-ss):04-36 



06/09/06 14:46 FAX 6508494800 BINGHAM McCUTCHEN LLP B009 



BEST AVAILABLE COPY 



Patent 
2021906-7001772001 
(21906-702) 

sending a second request to said network switch requesting said port information 
corresponding to said port index. 

22. (Previously Presented) The method of claim 14, wherein said network address 
information extraction and said port information determination are performed in an external 
monitor device. 

23. (Previously Presented) The method of claim 21, wherein said port information 
determination comprises placing said obtained portion of data packets in a first-in-first-out buffer 
waiting for responses from said network switch. 

24. (Previously Presented) The method of claim 23, wherein said port information 
determination further comprises releasing a data packet from said Erst-in-first-out buffer after said 
network switch responds to said first and second requests. 

25. (Previously Presented) The method of claim 23, wherein said port information 
determination further comprises releasing a data packet from said first-in-first-out buffer after a 
predetermined period of tirne. 

26. (Previously Presented) The method of claim 14/ further comprising maintaining at 
least one lookup table correlating said network address information with said port information. 
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27. (Previously Presented) The method of claim 14, wherein said network address 
information extraction and said port information determination are performed in an external 
monitor device. 

28. (Currently Amended) A method to monitor a network switch, comprising: 
externally obtaining at least a portion of data packets received a t transmitted from said 

network switch, wherein each of said data packets comprises network address information; 

extracting said network address infonnatidn from said obtained portion of data packets; 

and 

determining port information of said network address information in response to said 
network address information extraction. 

29. (Previously Presented) The method of claim 28, further comprising performing 
network analysis of said network switch using said port information. 

30. (Previously Presented) The method of claim 28, wherein said port information 
comprises physical information. 

31. (Previously Presented) The method of claim 28, wherein said network address 
information extraction and said port information determination is performed in an external 
monitoring device. 

32. (Previously Presented) The method of claim 28, wherein said network switch 
comprises a plurality of regular ports and a mirror port, said mirror port being able to mirror 
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network traffic for at least one of said regular ports, wherein said portion of data packets are 
obtained from said mirror port. 

33. (Previously Presented) The method of claim 28, wherein said network address 
information comprises source addresses. 

34. (Previously Presented) The method of claim 28, wherein said network address 
information comprises destination addresses. 

35. (Previously Presented) The method of claim 28, wherein said network switch 
comprises a plurality of regular ports, wherein said portion of data packets are obtained by 
passively tapping at least one of said regular ports. 

36. (Previously Presented) The method of claim 28, wherein said port information 
determination comprises interrogating said network switch to obtain said portion of port 
information using said network address information. 

37. (Previously Presented) The method of claim 36, wherein said interrogation 
comprises: 

sending a first request to said network switch requesting a port index corresponding to said 
network address information; and 

sending a second request to said network switch requesting said- port information 
corresponding to said port index. 
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38. (Previously Presented) The method of claim 37, wherein said first request and said 
second request are SNMP requests. 

39. (Previously Presented) The method of claim 37, wherein said port information 
determination comprises placing said obtained portion of data packets in a first-in-first-out buffer 
waiting for responses from said network switch. 

40. (Previously Presented) The method of claim 39, wherein said port information 
determination further comprises releasing a data packet from said first-in-first-out buffer after said 
network switch responds to said first and second requests. 

41. (Previously Presented) The method of claim 39, wherein said port information 
determination further comprises releasing a data packet from said first-in-first-out buffer after a 
predetermined period of time. 

42. (Previously Presented) The method of claim 28, further comprising maintaining at 
least one lookup table correlating said network address information with said port information, 

43. (Previously Presented) The method of claim 28, wherein said network switch is a 
routing switch. 

44. {Previously Presented) The method of claim 28, further comprising associating said 
port information with information contained in said obtained portion of data packets. 
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45. (Previously Presented) The method of claim 44, further comprising performing 
network analysis of said network switch using said port information and associated data packet 
information. 
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